Binding reference Bindings

Use mTLS Certificates in a Worker

mTLS certificate bindings let a Worker make outbound fetches with a client certificate.

Add the mTLS Certificates config, call from worker code, and start with the local test path Devflare supports.

Start with the config, wire the binding into worker code, then use the support section to decide whether local tests or Cloudflare-backed tests fit.

Config key
Authoring shape
Best for: calling origins that require a Cloudflare-uploaded client certificate

Add the binding to config

Add to , then use the generated env binding from Worker code.

Keep the first version close to the route or handler that needs it; move to a helper only after the shape is obvious.

Smallest mTLS Certificate config

import { defineConfig } from 'devflare/config'

export default defineConfig({

name: 'mtls-worker',

bindings: {

mtlsCertificates: {

CLIENT_CERT: {

certificateId: 'certificate-uuid'

}

})

Use the binding from application code

After Devflare generates the worker env, import from and keep the first mTLS Certificates path close to the route, handler, or service method that needs it.

Keep this first path small enough that the config, env binding, and user-visible behavior are easy to review together.

Fetch through the mTLS binding

import { env } from 'devflare/runtime'

export async function fetch(): Promise<Response> {

return env.CLIENT_CERT.fetch('https://origin.example/status')

}

Local and Remote Support

Devflare supports the config, generated env shape, docs, and local application-flow work, but full fidelity requires Cloudflare remote infrastructure. Use local shims or fixtures for code your app owns, then connect to Cloudflare when the product behavior is the assertion.

Offline-fixture: local tests can model Fetcher behavior, but not real certificate presentation. Keep local coverage focused on deterministic application flow through fixtures, mocks, shims, or Miniflare-backed wiring instead of pretending to reproduce Cloudflare-hosted product behavior.

Use Cloudflare when the assertion depends on cloudflare-hosted product behavior rather than the app calling the binding correctly. This is the lane for full mTLS Certificates product fidelity, remote state, lifecycle behavior, and platform-specific limits.

When this binding fits best

Use mTLS Certificates when calling origins that require a cloudflare-uploaded client certificate.
Keep binding names stable and uppercase in examples so generated Env declarations remain predictable.
Prefer Devflare native config while it covers the feature; use only for unsupported Wrangler-only fields.

Testing path

Start with with for config-backed local worker tests.
Use / for small unit tests that only need deterministic application behavior.
Use Cloudflare-backed tests when the assertion depends on hosted platform behavior, account state, limits, billing, or production routing.

Open the next page when you need it

Subpage

mTLS Certificates internals

Internals

Check emitted Wrangler , preview behavior, and Cloudflare-specific details.

Subpage

Testing mTLS Certificates

Testing

Pick the with path first, then move to remote checks only when the test needs them.

Subpage

mTLS Certificates example

Example

Copy a fuller application path when the quick example is too small.